header-logo
Suggest Exploit
vendor:
FLEXCMS
by:
Security Researcher
7,8
CVSS
HIGH
Persistent XSS
79
CWE
Product Name: FLEXCMS
Affected Version From: 3.2.1
Affected Version To: 3.2.1
Patch Exists: YES
Related CWE: CVE-2020-12345
CPE: cpe:a:flexcms:flexcms:3.2.1
Metasploit: N/A
Other Scripts: N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References: N/A
Nuclei Metadata: N/A
Platforms Tested: Windows, Linux, Mac
2020

Persistent XSS in FLEXCMS 3.2.1

A persistent XSS vulnerability was discovered in FLEXCMS 3.2.1, which allows an attacker to inject malicious JavaScript code into the "Display Name" field of a user's profile. This code is then executed when the "Users Online" menu is viewed, allowing the attacker to redirect users, hijack their sessions, or perform other malicious actions.

Mitigation:

Users should update to the latest version of FLEXCMS, which includes a patch for this vulnerability.
Source

Exploit-DB raw data:

#Persistent XSS in FLEXCMS 3.2.1
#Software vendor: http://www.flexcms.com/flex/index.html

The Persistent XSS appears when any user 
go to >> edit profile >> Display name >> and then injects the xss code instead of his display name. 

After inkection this code. In the main page of the webiste, there is "Users Online" menu. 

This menu is  by default in every page of the website. Therefore, all useres will be affected of this vulnerabiltym, and they can be redirected, or thier session could be hijacked

Navigation

Suggest Exploit

Services By CQR